7 matches found
WordPress AllCoach plugin < 1.0.2 - Unauthenticated Account Takeover vulnerability
Unauthenticated Account Takeover vulnerability discovered by Pedro Pinho in WordPress Plugin AllCoach versions 1.0.2...
CVE-2026-10830
The AllCoach WordPress plugin before 1.0.2 does not verify that an email address submitted to a public account-registration endpoint is not already associated with an existing user before overwriting that user's password, allowing unauthenticated attackers to reset the password of arbitrary...
CVE-2026-10830 AllCoach < 1.0.2 - Unauthenticated Account Takeover
The AllCoach WordPress plugin before 1.0.2 does not verify that an email address submitted to a public account-registration endpoint is not already associated with an existing user before overwriting that user's password, allowing unauthenticated attackers to reset the password of arbitrary...
EUVD-2026-41818
The AllCoach WordPress plugin before 1.0.2 does not verify that an email address submitted to a public account-registration endpoint is not already associated with an existing user before overwriting that user's password, allowing unauthenticated attackers to reset the password of arbitrary...
CVE-2026-10830
The AllCoach WordPress plugin, in versions prior to 1.0.2 , contains an unauthenticated account takeover vulnerability. The flaw exists because the plugin fails to verify if an email address submitted to a public account-registration endpoint is already associated with an existing user. Consequen...
CVE-2026-10830 AllCoach < 1.0.2 - Unauthenticated Account Takeover
The AllCoach WordPress plugin before 1.0.2 does not verify that an email address submitted to a public account-registration endpoint is not already associated with an existing user before overwriting that user's password, allowing unauthenticated attackers to reset the password of arbitrary...
PT-2026-55864
The AllCoach WordPress plugin before 1.0.2 does not verify that an email address submitted to a public account-registration endpoint is not already associated with an existing user before overwriting that user's password, allowing unauthenticated attackers to reset the password of arbitrary...